hashicorp/vault · warning · Error

invalid command

Error message

invalid command

What it means

Thrown by the Vault UI's embedded console parser (ui/app/lib/console-helpers.ts:130). parseCommand() tokenizes the typed command, takes the first token as the method, and only read, write, list, delete, and kv-get are supported HTTP-style commands (UI-only commands like api, clear, clearall, fullscreen, refresh are handled separately by executeUICommand). Any other leading token throws 'invalid command'.

Source

Thrown at ui/app/lib/console-helpers.ts:130

    } else {
      if (path) {
        const strippedArg = arg
          // we'll have arg=something or arg="lol I need spaces", so need to split on the first =
          .split(/=(.+)/)
          // if there were quotes, there's an empty string as the last member in the array that we don't want,
          // so filter it out
          .filter((str) => str !== '')
          // glue the data back together
          .join('=');
        data.push(strippedArg);
      } else {
        path = arg;
      }
    }
  });

  if (!supportedCommands.includes(method)) {
    throw new Error('invalid command');
  }
  return { method, flagArray: flags, path, dataArray: data };
}

interface LogResponse {
  auth?: StringMap;
  data?: StringMap;
  wrap_info?: StringMap;
  [key: string]: unknown;
}

export function logFromResponse(response: LogResponse, path: string, method: string, flags: Flags) {
  const { format, field } = flags;
  const respData: StringMap | undefined = response && (response.auth || response.data || response.wrap_info);
  const secret: StringMap | LogResponse = respData || response;

  if (!respData) {
    if (method === 'write') {

View on GitHub (pinned to 744b611b57)

Solutions

1. Use one of the supported verbs: read, write, list, delete, or kv-get (e.g. vault list secret/metadata, vault kv-get secret/foo)
2. Perform administrative operations (status, enable, unseal, audit) with the real vault CLI or against the HTTP API

const SUPPORTED = ['read', 'write', 'list', 'delete', 'kv-get'];
const [verb] = input.trim().split(/\s+/);
if (!SUPPORTED.includes(verb)) {
  showConsoleHelp(`Supported commands: ${SUPPORTED.join(', ')}. Other operations require the vault CLI.`);
  return;
}

try {
  const { method, path, flagArray, dataArray } = parseCommand(command);
} catch (e) {
  if (e.message === 'invalid command') {
    logToConsole(`invalid command — supported: read, write, list, delete, kv-get`);
  } else {
    throw e;
  }
}

When it happens

Trigger: Typing a vault CLI command whose verb is not in supportedCommands — e.g. vault status, vault operator init, vault secrets enable, vault audit enable, or a typo like readd — into the UI console.

Common situations: Users assume the web console has full parity with the vault CLI and paste arbitrary CLI commands; automation scripts or tutorials written for the CLI are copy-pasted into the console.

AI-assisted analysis of hashicorp/vault@744b611b57 (2026-08-15). Data as JSON: /api/errors/f5b76f81bf2f0f1b. Report an issue: GitHub.